Flux
Toutes les catégories

Cybersécurité

191 articles

Socket Is Sponsoring Composer and Packagist
Cybersécurité Programmation

Socket Is Sponsoring Composer and Packagist

Socket is a launch sponsor of the new Composer and Packagist sponsorship program, announced by Nils Adermann, Jordi Boggiano, and the team that keeps PHP's package infrastructure running. Like many other widely used open source registries, Packagist has been under mounting pressure to sustain critical infrastructure as the demands on it grow. "Usage keeps rising, supply chain attacks have increased in both frequency and sophistication, regulatory and compliance requirements around software…

Socket
Distributed npm Package Cluster Delivers Cross-Platform RAT Targeting Alibaba Developers
Cybersécurité Programmation

Distributed npm Package Cluster Delivers Cross-Platform RAT Targeting Alibaba Developers

Unknown threat actors distribute malicious downloader functionality separated across several npm packages targeting users of Alibaba tools. The final payload is a covert and highly targeted RAT capable of data exfiltration, command execution and lateral spreading using DingTalk tools Analysis of a malicious npm package lib-mtop containing a simple downloader malware led to an investigation into a targeted campaign that remained undetected for 3 months. The lib-mtop package, originally published…

Socket
Two Joyfill npm Beta Releases Compromised to Deliver DEV#POPPER Remote Access Trojan
Cybersécurité Programmation

Two Joyfill npm Beta Releases Compromised to Deliver DEV#POPPER Remote Access Trojan

Two npm beta releases in the @joyfill namespace contain an import-time JavaScript implant that resolves encrypted code through Tron, Aptos, and BNB Smart Chain transactions. Static analysis shows that its primary branch reaches a 77 KB Node.js remote-access trojan. A parallel branch launches a detached Node.js process, requests a separate boot payload from 23[.]27[.]13[.]43/$/boot, sends the marker header Sec-V: A9-0135-3, decrypts the response, and evaluates it. Joyfill provides software…

Socket
Socket Releases Free Certified Patches for Nuxt Security Vulnerabilities
Cybersécurité Programmation

Socket Releases Free Certified Patches for Nuxt Security Vulnerabilities

Nuxt has released security updates for multiple vulnerabilities affecting Nuxt 3.x and 4.x, along with a separate critical development-only vulnerability in @nuxt/devtools. Nuxt 4.5.1 and 3.21.10 address issues including server-side remote code execution, authorization bypass, denial of service, and cross-user payload disclosure. @nuxt/devtools 3.3.1 fixes a critical remote code execution vulnerability affecting development servers. Socket has published Certified Patches for two of the…

Socket
The AI Industry Is Betting on Open Weights
Cybersécurité Programmation

The AI Industry Is Betting on Open Weights

NVIDIA CEO Jensen Huang, who had long stayed off social media, posted on X for the first time on July 24. His debut was not a product launch or a GPU teaser. It was a policy letter, with one argument: Washington should not restrict open weight AI. Microsoft CEO Satya Nadella wrote on LinkedIn that open-weight models are "essential to a healthy AI ecosystem." The letter, Open Weights and American AI Leadership, launched with 25 signatures and now carries 50, a roster that runs from NVIDIA,…

Socket
Fake Corepack Site Distributes Infostealer and Proxyware to Developers
Cybersécurité Programmation

Fake Corepack Site Distributes Infostealer and Proxyware to Developers

A website at corepack[.]org is impersonating Corepack, the Node.js tool for managing package managers, and using that identity to push malware to developers who land on the page looking for a download. The site has existed in some form since early 2026 as a low-quality, apparently AI-generated imitation, but it recently started serving executable downloads. Socket's Threat Research team analyzed the site and confirmed it as a developer-targeted phishing and impersonation operation that drops an…

Socket
Large-Scale GitHub Actions Abuse Powers a Distributed cPanel and WHM Exploitation Campaign
Cybersécurité Programmation

Large-Scale GitHub Actions Abuse Powers a Distributed cPanel and WHM Exploitation Campaign

Malicious Packagist development versions exposed a broader GitHub Actions campaign that abuses compromised repositories to exploit CVE-2026-41940, a cPanel and WHM authentication bypass vulnerability, and harvest credentials from affected servers. Our investigation into malicious Packagist development versions associated with a legitimate PHP and DevOps developer, dinushchathurya, uncovered a large-scale GitHub Actions abuse campaign. Although the investigation began in the PHP package…

Socket
New Study Identifies 53 Slopsquatting Targets Across 5 Frontier LLMs
Cybersécurité Programmation

New Study Identifies 53 Slopsquatting Targets Across 5 Frontier LLMs

A new independent research preprint examining nearly 200,000 code-generation responses found that five frontier large language models continue to invent package names that do not exist on PyPI or npm. The models’ overall package-hallucination rates were much closer than those measured in earlier research, ranging from 4.62% to 6.10%. The study also identified package names generated by every model in the test group. The initial analysis found 127 names shared across Claude Sonnet 4.6, Claude…

Socket
White House Launches Gold Eagle Initiative to Manage Surge in AI-Discovered Vulnerabilities
Cybersécurité Programmation

White House Launches Gold Eagle Initiative to Manage Surge in AI-Discovered Vulnerabilities

The White House has launched a central clearinghouse to triage AI-discovered vulnerabilities and coordinate patches, but it has revealed little about how the system will operate. Its new Gold Eagle initiative aims to collect findings from government and industry, coordinate which software gets scanned, validate reported vulnerabilities, and prioritize patches across federal systems, critical infrastructure, and open source software. The administration publicly announced Gold Eagle on July 14,…

Socket
Suno Breached via Shai-Hulud Worm, Leaked Code Exposes AI Music Scraping
Cybersécurité Programmation

Suno Breached via Shai-Hulud Worm, Leaked Code Exposes AI Music Scraping

Leaked source code shows how AI music generator Suno scraped YouTube, Deezer, and Genius to train its models. The breach that exposed it started with a Shai-Hulud infection, according to a scoop from 404 Media. A threat actor using the handle ellie.191 told 404 Media they breached Suno by compromising a single employee with the Shai-Hulud worm, then used the harvested GitHub and cloud credentials to reach the company's source code, customer list, and Stripe payment data. The downstream impact…

Socket
Next.js moves to scheduled security releases
Cybersécurité Programmation

Next.js moves to scheduled security releases

Vercel announced that Next.js is adopting a formal security release program, replacing the ad-hoc patches the framework has shipped until now. Going forward, the team will publish advance notice of security releases on the Next.js blog roughly once a month. Each notice will state the expected release date and the highest anticipated severity of the fixes it covers. The first scheduled release is slated for July 20. It will ship patch releases for Next.js 16.2 and 15.5 and addresses 4 high and 5…

Socket
11 Malicious NuGet Tools Pose as Game Cheats to Drop a Windows Host-Surveillance Payload
Cybersécurité Programmation

11 Malicious NuGet Tools Pose as Game Cheats to Drop a Windows Host-Surveillance Payload

Socket’s Threat Research Team analyzed 11 malicious NuGet packages published as .NET command-line tools (DotnetTool package type) that present themselves as game utilities, bots, and “panels”. Every package is a first-stage downloader that fetches and executes a second-stage Windows payload named pepesoft.exe from GitHub Releases and Hugging Face paths under the username pepegit666, with dormant BitTorrent fallback code built in. The campaign splits cleanly into two stages: A .NET downloader…

Socket
Compromised npm Packages in the AsyncAPI Namespace Deliver Miasma Botnet Loader
Cybersécurité Programmation

Compromised npm Packages in the AsyncAPI Namespace Deliver Miasma Botnet Loader

Socket's Threat Research Team identified four compromised npm packages in the @asyncapi namespace distributing a multi-stage botnet loader. The affected packages are @asyncapi/generator-helpers@1.1.1, @asyncapi/generator-components@0.7.1, @asyncapi/generator@3.3.1 , @asyncapi/specs(v6.11.2, v6.11.2-alpha.1) Based on current analysis, the compromised packages deploy an obfuscated first-stage payload that downloads an encrypted second-stage payload, identified as Miasma, from IPFS. Users should…

Socket
jscrambler npm Package Compromised in Supply Chain Attack
Cybersécurité Programmation

jscrambler npm Package Compromised in Supply Chain Attack

A compromised release of the popular jscrambler npm package introduced hidden native binaries that execute automatically during npm install, exposing users to a supply chain attack before any application code runs. The malicious 8.14.0 release, published on July 11, adds an undocumented preinstall hook that invokes dist/setup.js. It also introduces new files, including dist/setup.js and dist/intro.js, along with platform-specific binaries for Linux, macOS, and Windows embedded in an obfuscated…

Socket
Fake Braintree NuGet Package Skims Credit Cards and Harvests Merchant Credentials
Cybersécurité Programmation

Fake Braintree NuGet Package Skims Credit Cards and Harvests Merchant Credentials

Socket’s AI scanner flagged a suspicious NuGet package masquerading as the official Braintree payment gateway client, with the first malicious version published on July 3, 2026. It was detected by Socket as potential malware 10 minutes after publication. Follow-on analysis by the Socket Threat Research team revealed a multi-stage .NET implant that intercepts live payment card data, exfiltrates Braintree merchant API keys and harvests host environment secrets upon assembly load. The package…

Socket